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DETAILED ACTION 

This action is in response to a request for continued examination filed 28 November 
2007. Claims 1,6-7, 9-12, 14-24, 37, 42, 44, and 46-47 are presented for further 
consideration. Claims 2-5, 8, 13, 25-36, 38-41, 45 and 48 are cancelled. Claims 1,-7, 9, 
11, 12, 23, 37, 42, 44 and 46-47 are currently amended. 

Continued Examination Under 37 CFR 1.114 

A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1 .17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.1 14, and the fee set 
forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 28 
November 2007 has been entered. 

Response to Arguments 

In regards to currently amended claim 1, the recitation "analyzing a stream of 
network usage data " has not been given patentable weight because the recitation 
occurs in the preamble. A preamble is generally not accorded any patentable weight 
where it merely recites the purpose of a process or the intended use of a structure, and 
where the body of the claim does not depend on the preamble for completeness but, 
instead, the process steps or structural limitations are able to stand alone. See In re 
Hirao, 535 F.2d 67, 190 USPQ 15 (CCPA 1976) and Kropa v. Robie, 187 F.2d 150, 



Application/Control Number: 09/919,527 Page 3 

Art Unit: 2153 

152, 88 USPQ 478, 481 (CCPA 1951). Therefore, the term "record event associated 
with an identifier", is not considered to be associated with a network usage identifier or 
rather a user of the network, but more broadly interpreted as an identifier associated 
with a record. Examiner further asserts that an identifier associated with a record is 
taught by Dietz as an identifier of the flow-entry (column 17, lines 9-60; Figure 3-item 
322). As a result, the indicated allowability of currently amended claim 1 is withdrawn in 
view of new interpretation of the claims over the prior art, as set forth below. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1,6,9-10 and 12 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Dietz et al (US Patent 6,839,751) in view of Rosenberg et al. (US Patent 
Application Publication 2003/0023951) and Steinbiss etal. (US Patent 6,823,307), 
hereinafter referred to as Dietz, Rosenberg and Steinbiss. 

In reference to claim 1, Dietz discloses a method for re-using information from data 
transactions for maintaining statistics in network monitoring. Dietz discloses (abstract; 
column 4, lines 14-33): 

• A method for analyzing a stream of usage data (Figure 3; column 8, lines 45-56), 
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comprising: 

• Generating a statistical model (i.e. statistical measures/network usage metrics; 
column 3, lines 14-33; column 17, lines 35-53) from a set of record events (i.e. 
flow-entry; column 10, line 55-column 11, line 5); 

• Receiving a most recent record event, (i.e. new packet of flow arrives at monitor; 
column 8, lines 45-62; Figure 3-item 302) and 

• Updating the statistical model using the most recent event by adding the most 
recent record to the statistical model (updating statistical measures stored in the 
flow-entry; column 11, lines 50-58; column 12, lines 55-67), wherein an identifier 
is associated with each record event (i.e. unique flow signature; column 11, lines 
15-49); 

• defining the statistical model to include an aggregation of each record event set 
stored in the history cache (columns 11-12); 

• wherein generating a statistical model from the set of record events includes 
generating an aggregation table (i.e. flow-entry table) for tracking an aggregation 
of record events associated with an identifier (columns 1 1-12); and 

• wherein the most recent record is associated with an identifier (i.e. unique flow 
signature); and wherein updating the statistical model includes updating only the 
aggregation of the record events in the tracking table for that identifier (i.e. 
updating statistical measures of the flow-entry that matches the unique flow 
signature/previously encountered flow; column 17, lines 9-60; Figure 3-item 322). 

However, the reference fails to disclose updating only a portion of the statistical model 
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associated with the identifier. Nonetheless, this would have been an obvious 
modification to the aforementioned method to one of ordinary skill in the art at the time 
of the invention, as further evidenced by Rosenberg. 

In an analogous art, Rosenberg discloses a method for data analysis and 
statistical modeling (abstract). Rosenberg further discloses updating only a portion of 
the statistical model associated with the identifier (i.e. updating statistical model for the 
new input data; paragraphs [0071]-[0073]; paragraph [0067]). This modification to the 
aforementioned method would have been obvious, because one of ordinary skill in the 
art would have been so motivated to present statistical summaries in a coherent and 
efficient manner for subset analysis to tackle large-scale problems (Rosenberg; 
paragraph [0067], lines 22-24; paragraph [0073], lines 8-12). Although Dietz and 
Rosenberg disclose substantial features of the aforementioned method such as storing 
the set of records in a history cache (column 17, lines 18-20), the references fail to 
explicitly disclose the method further comprising the step of: if the history cache is full, 
updating the statistical model includes removing a least recent event from the statistical 
model. Nonetheless, this would have been an obvious modification to the 
aforementioned method, to one of ordinary skill in the art at the time of the invention, as 
further evidenced by Steinbiss. 

In an analogous art, Steinbiss discloses a method for employing stochastic 
models that involves storing recently recognized elements in a cache, (abstract; column 
2, lines 25-38; and column 5, lines 15-30). Steinbiss further discloses once the cache is 
full, removing the least recently stored element, (column 5, line 60 to column 6, line 7). 
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This modification would have been obvious, because one of ordinary skill in the art 
would have been so motivated to implement this feature so as to maximize available 
memory space, thereby reducing cost associated with larger capacity cache memories, 
(Steinbiss column 5, line 66 to column 6, line 3). 

In reference to claims 6, 9 Dietz discloses generating a complex statistical model 
representative of the network data from the aggregation table (column 17, lines 35-59). 

In reference to claim 10, Dietz discloses updating the statistical model includes updating 
only a portion of the complex statistical model associated with an identifier (columns 17- 
18). 

In reference to claim 12, Steinbiss discloses upon receiving the most recent record 
event replacing the least recent record even stored in the history cache with the most 
recent record event, (column 5, line 60 to column 6, line 7). 

Claims 7, 11, and 14-22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Dietz, Rosenberg and Steinbiss as applied to claim 1 above, and further in 
view of Aboulnaga et al. (US Patent 6,460,045), hereinafter referred to as Dietz, 
Rosenberg and Aboulnaga. 

In reference to claims 7 and 1 1, although Dietz, Rosenberg and Steinbiss discloses 
substantial features of the claimed invention, the references fail to show generating a 
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histogram statistical model representative of the network data from the aggregation 
table. Nonetheless, histogram statistical models were well known in the art at the time of 
the invention, as further evidenced by Aboulnaga. Therefore, this limitation would have 
been an obvious modification to the aforementioned method, as disclosed by the 
references, for one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram 
statistical models, (column 5, line 37 to column 6, line 3). Aboulnaga further shows 
building a histogram that includes a first axis defined a number of bins (i.e. bins; Figure 
6-BUCKETS), each bin having a variable range (i.e. high to low; Figure 3; column 6, 
lines 30-55) and a second axis defined by a frequency (Figure 3&6) within the variable 
range of each bin, (columns 5-10). This modification would have been obvious to one of 
ordinary skill in the art, so as employ the bins and buckets of the aggregation table (I.e. 
flow-entry table; Dietz; column 17, lines 9-35) to increase the accuracy of the statistical 
model estimations and thereby increasing process effectiveness, (Aboulnaga column 1 , 
lines 54-55). 

In reference to claim 14, Steinbiss further discloses wherein if the history cache is full, 
updating the statistical model further includes removing a least recent record event set 
associated with a least recent update time interval from the statistical model, (column 5, 
line 60 to column 6, line 7). 

In reference to claim 15, Dietz discloses defining the statistical model to include an 



Application/Control Number: 09/919,527 Page 8 

Art Unit: 2153 

aggregation of each record event stored in the history cache (i.e. flow-entry table; 
columns 17-18). 

In reference to claim 16, Dietz discloses wherein the history cache is an array of 
memory segments, wherein the number of memory segments is equal to the number of 
update time intervals in the rolling time interval, (columns 17-18). 

In reference to claim 17, Dietz discloses storing each record event in a memory 
segment in the history cache, (columns 17-18). 

In reference to claim 18, Dietz discloses defining an index array associated including a 
set of contiguous index segments, wherein each index segment including a pointer to 
the memory segment storing in the history cache storing the next consecutive record 
event, (i.e. lookup engine; columns 17-18). 

In reference to claim 19, Dietz discloses defining a first pointer to the index segment 
associated with the memory segment storing the least recent record event, (i.e. lookup 
engine; columns 17-18). 

In reference to claim 20, Steinbiss discloses wherein upon receiving a most recent 
record event the method further comprising replacing the least recent record event 
stored in the history cache with the most recent record event, (column 5, line 60 to 
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column 6, line 7). 
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In reference to claim 21 , Dietz discloses, moving the first pointer to the next contiguous 
index segment, (i.e. lookup engine; columns 17-18). 

In reference to claim 22, Dietz discloses further defining a second pointer to the index 
segment associated with the memory segment storing the most recent record event, 
(i.e. lookup engine; columns 17-18). 



Allowable Subject Matter 

Claims 23-24, 37, 42, 44 and 46-47 are allowable as the prior art of record fails to 
teach or suggest individually or in combination the claimed limitations of a method for 
analyzing a stream of network usage data comprising updating a statistical model, 
wherein updating the statistical model includes updating only the aggregation of records 
in the tracking table for that identifier . 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to LaShanya R Nash whose telephone number is (571) 
272-3957. The examiner can normally be reached on 9am-5pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Glenton Burgess can be reached on (571) 272-3949. The fax phone 
number for the organization where this application or proceeding is assigned is (571) 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



LaShanya Nash j 
Art Unit, 2153 / 
February 18, 2008 




